--- title: "Lookup a Hash entity by id" method: GET path: "/hash/{id}" tags: ["Hash"] --- # Lookup a Hash entity by id `GET /hash/{id}` ## Request - Base URL: `https://api.recordedfuture.com/v2` - URL: `https://api.recordedfuture.com/v2/hash/{id}` - Auth: API key in header `X-RFToken` Get full hash enrichment including risk scoring, malware family attribution, and MITRE ATT&CK mappings. ## Path parameters - `id` string, required ## Query parameters - `fields` string - `metadata` unknown - `taggedText` boolean - `comment` string ## Response `200` Result of operation - HashLookupResponse: File hash enrichment response. The response includes only the fields specified in the `fields` query parameter. All properties under `data` are optional because they appear only when requested. - `data` object, required: Hash entity data with requested enrichment fields. - `entity` Entity: Recorded Future entity identification. - `id` string, required: Recorded Future entity ID. Format varies by type: ip:1.2.3.4, idn:example.com, hash:, url:https://..., or opaque alphanumeric IDs for vulnerabilities, malware, and companies. - `name` string, required: Human-readable entity name. - `type` 'IpAddress' | 'InternetDomainName' | 'Hash' | 'URL' | 'CyberVulnerability' | 'Malware' | 'Company', required: Entity type classification. - `description` string: Entity description (present for vulnerabilities and some other types). - `risk` RiskData: Risk assessment data with score, triggered rules, and supporting evidence. Included when the fields parameter contains 'risk'. Not available for Malware entities. - `score` integer: Numeric risk score from 0 (no risk) to 99 (critical risk). - `criticality` integer: Numeric criticality level (0=None, 1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'None' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Risk criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `riskString` string: Triggered vs total risk rules (e.g., '16/81'). - `rules` integer: Number of currently triggered risk rules. - `riskSummary` string: Human-readable risk summary (e.g., '16 of 81 Risk Rules currently observed.'). - `evidenceDetails` EvidenceDetail[]: Evidence for each triggered risk rule. - `rule` string: Risk rule name that was triggered. - `criticality` integer: Numeric criticality level of the rule (1=Informational, 2=Unusual, 3=Suspicious, 4=Malicious). - `criticalityLabel` 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High': Human-readable criticality label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. - `evidenceString` string: Human-readable evidence summary with source references and sighting details. - `mitigationString` string: Recommended mitigation or remediation guidance for this risk rule. - `timestamp` string, date-time: ISO 8601 timestamp of when the evidence was observed. - `aiInsights` AiInsights: AI-generated threat analysis. Included when the fields parameter contains 'aiInsights'. Text is null when fewer than 3 risk rules are triggered. - `text` string, nullable: AI-generated threat analysis paragraph. Null when fewer than 3 risk rules are triggered. - `numberOfReferences` integer: Number of intelligence references used to generate the insight. - `comment` string, nullable: Explanatory comment (e.g., why insights are not available). - `links` LinksData: Validated intelligence relationships to threat actors, malware, MITRE ATT&CK techniques, and other entities. Included when the fields parameter contains 'links'. Unlike relatedEntities, these are editorially validated relationships. - `hits` object[]: Intelligence hits containing sectioned relationship data. - `start_date` string: Start date of the intelligence hit time window. - `stop_date` string: End date of the intelligence hit time window. - `total_count` integer: Total number of entity relationships in this hit. - `sample_reference_ids` string[]: Sample reference IDs supporting this hit. - `counts` object[]: Breakdown counts by entity type. - `count` integer: Number of entities. - `type` object: Entity type metadata. - `id` string - `name` string - `type` string - `event_count` integer: Number of events in this hit. - `sections` object[]: Relationship sections grouped by category. - `section_id` object: Section identifier. - `id` string: Section ID. - `name` string: Section category name (e.g., 'Actors, Tools & TTPs', 'Victims & Exploit Targets', 'Indicators & Detection Rules'). - `type` string: Section type (e.g., 'Category'). - `total_count` integer: Total entities in this section. - `lists` object[]: Entity lists within this section, grouped by entity type. - `entities` LinksEntity[] - … - `total_count` integer: Total entities in this list. - `type` object: Entity type metadata for this list. - … - `method_aggregates` object[]: Aggregated counts of linked entities by analysis method. - `count` integer: Number of links found by this method. - `type` string: Analysis method type. - `counts` object[]: Summary counts of linked entities by type. - `count` integer: Number of linked entities of this type. - `type` object: Entity type metadata. - `id` string - `name` string - `type` string - `description` string - `intelCard` string, uri: URL to the Recorded Future Intelligence Card for this hash. - `hashAlgorithm` 'SHA-256' | 'SHA-1' | 'MD5': Algorithm of the queried hash. - `fileHashes` string[]: All known hash variants for this file (SHA-256, SHA-1, MD5). - `sightings` Sighting[]: Intelligence sightings from various source types. Each item's `type` field indicates the category (recentDarkWeb, recentPaste, recentInfoSec, recentSocialMedia, mostRecent, first). Included when the fields parameter contains 'sightings'. - `source` string: Source name (e.g., 'GitHub', 'PasteBin', 'Turk Hack Team Forum'). - `url` string, uri: URL to the original source. - `published` string, date-time: ISO 8601 timestamp of when the sighting was published. - `fragment` string: Text fragment from the source mentioning the entity. - `title` string: Title of the source document. - `type` 'recentDarkWeb' | 'recentPaste' | 'recentInfoSec' | 'recentSocialMedia' | 'mostRecent' | 'first': Sighting category. - `threatLists` ThreatList[]: Curated threat list memberships. - `id` string: Threat list entity ID. - `name` string: Threat list name. - `type` string: Entity type (e.g., 'EntityList'). - `description` string: Description of the threat list and its purpose. - `riskMapping` RiskMapping[]: Risk rule to MITRE ATT&CK mapping. - `rule` string: Risk rule name. - `categories` object[]: Framework categories this rule maps to. - `framework` string: Framework name (e.g., 'MITRE ATT&CK'). - `name` string: Category or technique name. - `timestamps` Timestamps: First and last seen timestamps for the entity in Recorded Future data. - `firstSeen` string, date-time: ISO 8601 timestamp of first observation. - `lastSeen` string, date-time: ISO 8601 timestamp of most recent observation. - `analystNotes` object[]: Insikt Group analyst notes. Can be very large. - `relatedEntities` object[]: Co-occurrence relationships (not editorially validated). - `counts` object[]: Daily reference count time-series. - `metrics` object[]: Flat metric counters. - `enterpriseLists` object[]: Enterprise-specific list memberships. - `metadata` object: Request metadata. Included when the metadata query parameter is set to true. --- [API](https://skmtc.dev/recordedfuture/apis/connect-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/connect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/connect-api/revisions/ca0276d265f0?raw)